Fluentauth
Monthly
Unauthenticated remote attackers can spoof identities and potentially take over accounts on WordPress sites running the FluentAuth (fluent-security) plugin through version 2.1.2 due to insufficient verification of data authenticity (CWE-345). The vendor CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), which reflects a remotely reachable, low-complexity integrity flaw with limited impact, but our assessment raises the integrity impact to High (I:H) given the authentication bypass to account takeover described in the advisory. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, yet the flaw requires no authentication, user interaction, or special conditions beyond an internet-reachable install with the vulnerable plugin active.
Unauthenticated remote attackers can spoof identities and potentially take over accounts on WordPress sites running the FluentAuth (fluent-security) plugin through version 2.1.2 due to insufficient verification of data authenticity (CWE-345). The vendor CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), which reflects a remotely reachable, low-complexity integrity flaw with limited impact, but our assessment raises the integrity impact to High (I:H) given the authentication bypass to account takeover described in the advisory. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, yet the flaw requires no authentication, user interaction, or special conditions beyond an internet-reachable install with the vulnerable plugin active.